Skip to content
HackIndex.io

Manual Network Connection with wpa_supplicant

2 min read Created Mar 17, 2026 Last updated Aug 11, 2026

After recovering a WPA/WPA2 passphrase or enterprise credentials, connecting to the network directly gives you a routable IP address and full access to the internal segment. For a wpa_supplicant manual connection on Kali, you get direct control without depending on NetworkManager: useful when NetworkManager has been killed for monitor mode or when connecting to enterprise networks that require specific EAP configuration. nmcli is the simplest method when NetworkManager is running, but wpa_supplicant and dhclient work in situations where NetworkManager is unavailable or interferes.

Connect to a WPA/WPA2 Personal Network with nmcli

The fastest method when NetworkManager is running:

┌──(kali㉿kali)-[~]
└─$ nmcli dev wifi connect "TargetNetwork" password "recoveredpassword" 
Device 'wlan0' successfully activated with 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'.

If NetworkManager was killed for monitor mode, restart it first:

┌──(kali㉿kali)-[~]
└─$ systemctl start NetworkManager
┌──(kali㉿kali)-[~]
└─$ nmcli dev wifi connect "TargetNetwork" password "recoveredpassword"

wpa_supplicant Manual Connection on Kali

When you need direct control without NetworkManager, generate a wpa_supplicant configuration from the SSID and passphrase:

┌──(kali㉿kali)-[~]
└─$ wpa_passphrase TargetNetwork recoveredpassword > /tmp/wpa.conf

Start wpa_supplicant against the interface in managed mode:

┌──(kali㉿kali)-[~]
└─$ wpa_supplicant -D nl80211 -i wlan0 -c /tmp/wpa.conf -B 
Successfully initialized wpa_supplicant

-D nl80211 specifies the driver. -B runs wpa_supplicant in the background. After a few seconds, check the connection status:

┌──(kali㉿kali)-[~]
└─$ wpa_cli status 
wpa_state=COMPLETED
ssid=TargetNetwork
bssid=aa:bb:cc:dd:ee:ff
ip_address=192.168.1.105

wpa_state=COMPLETED confirms the 4-way handshake completed and the session is active. If an IP is not shown, request one with dhclient.

Request an IP Address with dhclient

After wpa_supplicant connects, request a DHCP lease:

┌──(kali㉿kali)-[~]
└─$ dhclient wlan0

Verify the assigned address and gateway:

┌──(kali㉿kali)-[~]
└─$ ip addr show wlan0
┌──(kali㉿kali)-[~]
└─$ ip route show

Connect to a WPA Enterprise Network with wpa_supplicant

Enterprise connections require a more detailed wpa_supplicant configuration. Create the config manually for PEAP/MSCHAPv2:

┌──(kali㉿kali)-[~]
└─$ cat > /tmp/enterprise.conf << 'EOF'
network={
ssid="CorpWifi"
key_mgmt=WPA-EAP
eap=PEAP
identity="CORP\\jsmith"
password="recoveredpassword"
phase2="auth=MSCHAPV2"
ca_cert="/etc/ssl/certs/ca-certificates.crt"
}
EOF
┌──(kali㉿kali)-[~]
└─$ wpa_supplicant -D nl80211 -i wlan0 -c /tmp/enterprise.conf -B
┌──(kali㉿kali)-[~]
└─$ dhclient wlan0

If the enterprise network uses a self-signed or internal CA certificate, set ca_cert to the path of the CA file or remove the line entirely and add phase1="peaplabel=0" and ca_cert="" to skip certificate validation: only appropriate when the network is already known to not validate certificates.

Troubleshooting wpa_supplicant Connection Issues

Common problems when connecting with wpa_supplicant on Kali:

  • "nl80211: Could not configure driver mode": the interface is still in monitor mode. Bring it down and set it to managed mode: ip link set wlan0 down && iw wlan0 set type managed && ip link set wlan0 up.
  • "CTRL-EVENT-ASSOC-REJECT": the AP rejected the association. Verify the SSID and passphrase are correct. For enterprise networks, double-check the identity format (DOMAIN\user vs user@domain).
  • wpa_supplicant hangs with no output: NetworkManager may be fighting for control of the interface. Kill it with systemctl stop NetworkManager or use wpa_supplicant with -D wext as an alternative driver.
  • No IP address after successful association: dhclient may have timed out or the DHCP server did not respond. Run dhclient -v wlan0 for verbose output. If DHCP fails repeatedly, assign a static IP in the same subnet observed during reconnaissance.
  • Connection drops after a few seconds: another process is reconfiguring the interface. Check for wpa_supplicant instances already running with ps aux | grep wpa_supplicant and kill duplicates.

When to Use nmcli vs wpa_supplicant

Choose based on your situation:

  • Use nmcli when NetworkManager is running and you need a quick WPA-Personal connection. It handles DHCP, DNS, and routing automatically.
  • Use wpa_supplicant when NetworkManager is stopped (common after running airmon-ng), when you need enterprise EAP configuration, or when you need to connect to a hidden SSID with specific parameters.
  • Use wpa_supplicant when you want to avoid NetworkManager logging connection details to system journals, which matters for OPSEC on a shared system.

Disconnect and Clean Up

┌──(kali㉿kali)-[~]
└─$ dhclient -r wlan0
┌──(kali㉿kali)-[~]
└─$ killall wpa_supplicant

References